Fansmitter: Acoustic data exfiltration from air-Gapped computers via fans noise

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Zadov

Bykhovsky

et al. 2019

Self Cite

Using the keyboard LEDs to send data optically was proposed in 2002 by Loughry and Umphress [1] (Appendix A). In this paper we extensively explore this threat in the context of a modern cyber-attack with current hardware and optical equipment. In this type of attack, an advanced persistent threat (APT) uses the keyboard LEDs (Caps-Lock, Num-Lock and Scroll-Lock) to encode information and exfiltrate data from airgapped computers optically. Notably, this exfiltration channel is not monitored by existing data leakage prevention (DLP) systems. We examine this attack and its boundaries for today's keyboards with USB controllers and sensitive optical sensors. We also introduce smartphone and smartwatch cameras as components of malicious insider and 'evil maid' attacks. We provide the necessary scientific background on optical communication and the characteristics of modern USB keyboards at the hardware and software level, and present a transmission protocol and modulation schemes. We implement the exfiltration malware, discuss its design and implementation issues, and evaluate it with different types of keyboards. We also test various receivers, including light sensors, remote cameras, 'extreme' cameras, security cameras, and smartphone cameras. Our experiment shows that data can be leaked from air-gapped computers via the keyboard LEDs at a maximum bit rate of 3000 bit/sec per LED given a light sensor as a receiver, and more than 120 bit/sec if smartphones are used. The attack doesn't require any modification of the keyboard at hardware or firmware levels.

Section: A Air-gap Exfiltrationmentioning

confidence: 99%

Section: A Electromagnetic Magnetic Acoustic and Thermalmentioning

confidence: 99%

Section: A Electromagnetic Magnetic Acoustic and Thermalmentioning

confidence: 99%

See 1 more Smart Citation

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Zadov

Bykhovsky

et al. 2019

Self Cite

“…Hanspach and Goetz [12] present a method for near-ultrasonic covert networking using speakers and microphones. Fansmitter and Diskfiltration [13], [14] are another methods of acoustic data exfiltration from computers without loudspeakers. BitWhisper [15] demonstrates a covert communication channel between adjacent air-gapped computers by using their heat emissions and built-in thermal sensors.…”

Section: Related Workmentioning

confidence: 99%

Brightness: Leaking Sensitive Data from Air-Gapped Workstations via Screen Brightness

2019 12th CMI Conference on Cybersecurity and Privacy (CMI)

Bykhovsky

Elovici³

2019

Self Cite

Air-gapped computers are systems that are kept isolated from the Internet since they store or process sensitive information. In this paper, we introduce an optical covert channel in which an attacker can leak (or, exfiltlrate) sensitive information from air-gapped computers through manipulations on the screen brightness. This covert channel is invisible and it works even while the user is working on the computer. Malware on a compromised computer can obtain sensitive data (e.g., files, images, encryption keys and passwords), and modulate it within the screen brightness, invisible to users. The small changes in the brightness are invisible to humans but can be recovered from video streams taken by cameras such as a local security camera, smartphone camera or a webcam. We present related work and discuss the technical and scientific background of this covert channel. We examined the channel's boundaries under various parameters, with different types of computer and TV screens, and at several distances. We also tested different types of camera receivers to demonstrate the covert channel. Lastly, we present relevant countermeasures to this type of attack.

“…2) GSMem: Similar to AirHopper, the GSMem attack [50], enables leaking the data from air-gapped wallets to nearby mobile phones. In this technique malware generates interferences in the cellular bands of the GSM, UMTS, and LTE specification.…”

Section: Unsigned Transaction/ Wallet Installationmentioning

confidence: 99%

BeatCoin: Leaking Private Keys from Air-Gapped Cryptocurrency Wallets

2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and I

2018

Self Cite

demo video (1): https://youtu.be/2WtiHZNeveY demo video (2): https://youtu.be/ddmHOvT866oAbstract-Cryptocurrency wallets store the wallets private key(s), and hence, are a lucrative target for attackers. With possession of the private key, an attacker virtually owns all of the currency in the compromised wallet. Managing cryptocurrency wallets offline, in isolated ('air-gapped') computers, has been suggested in order to secure the private keys from theft. Such air-gapped wallets are often referred to as 'cold wallets.'In this paper we show how private keys can be exfiltrated from air-gapped wallets. In the adversarial attack model, the attacker infiltrates the offline wallet, infecting it with malicious code. The malware can be preinstalled or pushed in during the initial installation of the wallet, or it can infect the system when removable media (e.g., USB flash drive) is inserted into the wallet's computer in order to sign a transaction. These attack vectors have repeatedly been proven feasible in the last decade (e.g., [1],[2],[3],[4],[5],[6],[7],[8],[9],[10]). Having obtained a foothold in the wallet, an attacker can utilize various air-gap covert channel techniques (bridgeware [ 11]) to jump the airgap and exfiltrate the wallets private keys. We evaluate various exfiltration techniques, including physical, electromagnetic, electric, magnetic, acoustic, optical, and thermal techniques. This research shows that although cold wallets provide a high degree of isolation, its not beyond the capability of motivated attackers to compromise such wallets and steal private keys from them. We demonstrate how a 256-bit private key (e.g., bitcoin's private keys) can be exfiltrated from an offline, air-gapped wallet of a fictional character named Satoshi within a matter of seconds 1 .